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IN THE CLAIMS 

1. (Currently Amended) An apparatus comprising: 

a network interface module to connect the apparatus to a network; 

a packet capture module to intercept packets being transmitted on the network; 

an object assembly module to reconstruct flows representing objects being 
transmitted on the network from the intercepted packets , the packets associated 
with a document that includes the objects, wherein the document is captured 
based on a capture rule that specifies the objects, and wherein a determination 
is made as to whether to discard or to store the objects of the document; 

an object classification module to determine a type of content of and 
reconstruct objects from the flows; 

an object store module to store the objects; and 

a user interface to enable a user to search objects stored in the object store 
module, wherein the objects are searched based on a query, which includes search 
criteria used to identify selected objects that match the search criteria. 

2. (Original) The apparatus of claim 1, wherein the object assembly module 
comprises a reassembler to assemble the intercepted packets into flows. 

3. (Original) The apparatus of claim 2, wherein the object assembly module further 
comprises a protocol demultiplexer to sort the assembled flows by protocol. 

4. (Original) The apparatus of claim 3, wherein the object assembly module further 
comprises a protocol classifier to extract the objects from the sorted assembled flows. 
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5. (Original) The apparatus of claim 1, wherein the object classification module 
determines whether objects are stored in the object store or discarded based on one or more 
capture rules. 

6. (Original) The apparatus of claim 5, wherein the capture rules are user- 
configurable through the user interface. 

7. (Original) The apparatus of claim 1, wherein the object classification module 
determines a location that each object is stored in the object store based on the type of 
content of each object. 

8. (Original) The apparatus of claim 1, wherein the object classification module 
determines the type of content of each object using a signature of each object. 

9. (Original) The apparatus of claim 1, wherein the user interface comprises a 
graphical user interface. 

10. (Original) The apparatus of claim 1, wherein the object store module comprises 
a content store to store the objects and a tag store to index the objects stored in the object 
store. 

11. (Original) The apparatus of claim 10, wherein the content store comprises a 
canonical storage, and the tag store comprises a database. 
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12. (Currently Amended) A method comprising: 
intercepting data being transmitted on a network; 

reconstructing flows of objects being transmitted on the network from the 
intercepted data; 

classifying the reconstructed objects by content type , the data associated with 
a document that includes the objects, wherein the document is captured based 
on a capture rule that specifies the objects, and wherein a determination is 
made as to whether to discard or to store the objects of the document ; 

creating a tag to describe each reconstructed object; 
storing the classified objects and tags; and 

indexing the stored objects to enable searching of the stored objects via the 
tags, wherein the objects are searched based on a query, which includes search criteria 
used to identify selected objects that match the search criteria. 

13. (Previously Presented) The method of claim 12, wherein reconstructing the 
objects comprises: 

sorting the intercepted data into packets; and 
sorting the assembled flows by protocol. 

14. (Original) The method of claim 12, further comprising determining whether each 
object is to be stored based on a set of one or more capture rules. 



15. (Original) The method of claim 12, further comprising receiving a query over the 
stored objects. 
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16. (Original) The method of claim 15, further comprising searching the indexed 
objects, and retrieving objects matching the query. 

17. (Currently Amended) A machine-readable storage medium having stored 
thereon data representing instructions that, when executed by a processor, cause the 
processor to perform operations comprising: 

intercepting data being transmitted on a network; 

reconstructing flows of objects being transmitted on the network from the 
intercepted data; 

classifying the reconstructed objects by content type , the data associated with 
a document that includes a plurality of objects that identify characteristics of the 
document, wherein the document is captured based on a capture rule that 
specifies the objects, and wherein a determination is made as to whether to 
discard or to store the objects of the document ; 

creating a tag to describe each reconstructed object; 

storing the classified objects and tags; and 

indexing the stored objects to enable searching of the stored objects via the 
tags, wherein the objects are searched based on a query, which includes search criteria 
used to identify selected objects that match the search criteria. 

18. (Previously Presented) The machine-readable storage medium of claim 17, 
wherein reconstructing the objects comprises: 

sorting the intercepted data into packets; and 
sorting the assembled flows by protocol. 
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19. (Previously Presented) The machine-readable storage medium of claim 17, 
wherein the instructions further cause the processor to determine whether each object is to be 
stored based on a set of one or more capture rules. 

20. (Previously Presented) The machine-readable storage_medium of claim 17, 
wherein the instructions further cause the processor to receive a query over the stored objects, 
search the indexed objects in response to the query, and retrieve objects matching the query. 



